Google Chrome CVE-2026-95322

Requires the victim to actively open or be redirected to attacker-controlled web content in an unpatched Chrome build below 154.0.8037.57 (UI:R). Exploitation is not turnkey: AC:H means the attacker must satisfy a specific precondition - typically heap grooming, a race, or a particular object/memory state - before the out-of-bounds write is reachable, which limits reliability and mass-exploitation. No authentication is required (PR:N) and it is network-reachable (AV:N). The scope change (S:C) implies the corruption crosses the renderer sandbox boundary. Limiting factors: mandatory user interaction, the AC:H precondition, and the fact that a patch is already available so exposure is confined to un-updated clients.

This is a genuinely high-priority browser vulnerability, though not the top tier of the September 2026 Chrome batch. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H, 8.3) describes an unauthenticated, network-reachable memory-corruption bug (CWE-787 out-of-bounds write) triggered by user interaction (visiting a malicious page), with S:C indicating a scope change - consistent with a renderer-to-broker/sandbox-escape-class primitive rather than a renderer-contained bug. The one signal that tempers raw severity is AC:H: exploitation requires meeting a non-trivial precondition (heap grooming, timing, or a specific state), which is why the score sits at 8.3 rather than the 9.6 seen in the AC:L/S:C siblings (e.g. CVE-2026-95350/95329/95357). Exploitation status: no public exploit identified at time of analysis - there is no EPSS score, no CISA KEV listing, and no POC in the provided data; absence of these should not be read as safety for a browser flaw, as Chrome N-day exploits are frequently reconstructed from patch diffs shortly after release. A patch is confirmed available from the vendor. Net: real priority driven by ubiquity and full C/I/A impact with scope change, moderated by AC:H and the lack of any confirmed in-the-wild activity.

An attacker hosts a malicious web page (or compromises an ad/iframe on a legitimate site) containing content crafted to trigger the out-of-bounds write in a vulnerable Chrome component. A victim on an unpatched build (<154.0.8037.57) visits the page; after the attacker achieves the required heap/timing precondition (AC:H), the OOB write corrupts memory to gain code execution and, given S:C, escape the renderer sandbox. No public POC is present in the provided data.